That's not what is meant. An attacker who wants to find out of if the person with "example@example.com" has on account on your website, could try signing up wi

That's not what is meant. An attacker who wants to find out of if the person with "example@example.com" has on account on your website, could try signing up with "example@example.com". If they get an error message, they know the person has an account on the website.